0

I'm working on an Ubuntu based browser distro that is meant to be ran live. Part of the security solution is to use sdmem when it shuts down. sdmem wipes the available ram and is found in the package secure-delete in Ubuntu repos. sdmem is not being called in the scripts below.

I've had this solution working for another project set up the same way, so I know it works. But sometimes in the other project on shutdown and restart I didn't always get the standard out that sdmem gives when wiping. (Normally sdmem spits out a bunch of asterisks.) I've disabled graphical plymouth so I can look for the output.

Here is my script info:

internet@linux-surfer /etc/init.d $ cat dram.sh 
#!/bin/sh

# give this script permissions:
# chmod +x sdmem.sh

# sdmem  will delete  data which may lie still in your memory (RAM) 
# The secure data deletion process of sdmem goes like this:
# *      1 pass with 0x00
# *      5 random passes. /dev/urandom is used for a secure RNG if available.
# *      27 passes with special values defined by Peter Gutmann.
# *      5 random passes. /dev/urandom is used for a secure RNG if available.

sdmem -fllv
sdmem -fllv
sdmem -fllv
sdmem -fllv
sdmem -fllv
sdmem -fllv
sdmem -fllv
sdmem -fllv
sdmem -fllv

# this script need to be added to shutdown this way:
#sudo cp sdmem.sh /etc/init.d
#sudo ln -s /etc/init.d/sdmem.sh /etc/rc0.d/K11dram.sh
#sudo ln -s /etc/init.d/sdmem.sh /etc/rc6.d/K11dram.sh

Permissions:

internet@linux-surfer /etc/init.d $ ls dram.sh -l
-rwxr-xr-x 1 internet internet 743 2012-02-18 00:31 dram.sh

Upstart script:

internet@linux-surfer /etc/init $ cat dram.conf 
start on runlevel [06]

script
    sdmem -fllv
end script
internet@linux-surfer /etc/init $ 

Permissions:

internet@linux-surfer /etc/init $ ls -l dram.conf 
-rw-r--r-- 1 root root 55 2012-02-18 01:35 dram.conf

1 Answer 1

2

The problem is that your script is going to race with the rest of the shutdown/reboot procedure.

start on runlevel [06]

The runlevel event does not delay anything, so you have a race.. the event is just a signal in time, and so your sdmem starts running as soon as the shutdown sequence in /etc/rc0.d/* starts running, and they both run in parallel.

If you want to delay things you have two options. Either a)

task
start on starting rc RUNLEVEL=[06]

This will delay the entire shutdown from even starting until your sdmem exits. Note that the 'task' is important there as the job will not block other jobs until sdmem exits.

b)

task
start on some-other-late-hook-event

And then edit whatever script in /etc/rc0.d/* (or /etc/rc6.d/*) you want to emit this event and have it do

initctl emit some-other-late-hook-event

That call in whatever script you want it in, will block until sdmem exits. Note again the 'task'.

4
  • Thank you. Now it makes sense what to do. I just assumed a laundry list that would be completed. I had no idea things were threaded and shutdown could kill my sdmem.
    – bambuntu
    Feb 22, 2012 at 5:27
  • Is there a difference besides syntax between: start on runlevel [06] and start on starting rc RUNLEVEL=[06]
    – bambuntu
    Feb 23, 2012 at 21:19
  • BIG difference. the runlevel event is, as I said, a non-blocking event.. so everything that starts on it just GOES. The 'starting' event is waited on, so the 'rc' script (which controls runlevel transitions for sysv compatibility) will not even start to run until any blocking tasks (like your job) are completed because the starting event will be waited on.
    – SpamapS
    Feb 27, 2012 at 23:26
  • Wow. I wish I knew that before. It cost me some time and confusion. Thank you.
    – bambuntu
    Feb 28, 2012 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .